Hello, im building a ring0 kmdf driver.
I am using KeStackAttachProcess to read virtual memory of a specific process.
The problem is, i do not seem to have write permissions to the specific memory
area id like to change.
Iv'e tried using NtVirtualProtect but it does not seem to work.
I assumed as kernel id have write access to whichever address i wanted, but i
dont seem to have that priviledge.
I thought about, since i can read from the process, reading all physical memory
(4GB of ram in my case) - and searching for the specific thing i want to change,
and somehow writing over it.
Can anyone please point me in the right direction to doing such thing or an
alternative?
Thanks, Yuval.

Message 2 of 2

12 Feb 18 18:14

Alex Grig

xxxxxx@broadcom.com

Join Date: 14 Apr 2008

Posts To This List: 3233

Reading/Writing to Physical Memory

Keep in mind that not all memory of a process is mapped.

Posting Rules

You may not post new threads

You may not post replies

You may not post attachments

You must login to OSR Online AND be a member of the ntdev list to be able to post.